Today, 11 April 2024, the Court of Justice of the European Union (CJEU) delivered its judgment in case C-741/21, GP v juris GmbH.
This case concerns a dispute regarding compensation for non-material damage allegedly suffered by a data subject due to the loss of control over their personal data, despite objecting to the processing. In its defense, the controller argued that the delayed consideration of the applicant’s objections was either due to a staff member not following instructions or because it would have been excessively costly to consider those objections.
The CJEU addressed the referred questions as follows:
1. In line with its its previous rulings, for example in C‑300/21 (Österreichische Post), C‑340/21 (Natsionalna agentsia za prihodite), or more recently in C‑687 /21 (MediaMarktSaturn), the CJEU highlights that the mere infringement of the GDPR, regardless of the seriousness of the offense, is not sufficient to confer a right to compensation, but the following three cumulative conditions apply:
- “damage” or “harm” which has been “suffered”
- an infringement of the GDPR
- a causal link between that damage and that infringement
2. A controller cannot be exempt from liability relying on Art. 82 paragraph 3 of the GDPR simply by citing negligence or misconduct on the part of a person under its authority.
In this respect, proving that the controller has given instructions to the persons under its authority is not sufficient to benefit from this exemption, but it has to prove that there is no causal link between the possible breach of the data protection obligation and the damage caused to the data subject.
3. The criteria used for determining the amounts of fines (punitive function) cannot be used to determine the amount of damages under Article 82 of the GDPR (compensatory function).
Moreover, the fact that the controller has committed several infringements against the same data subject cannot be considered as a relevant criterion for determining the compensation to be awarded, but only the actual damage suffered by that person must be taken into account.
The judgment of the CJEU is available here (currently available only in German and French).
